redline | 4ae69707fe39339915373a1ec3adaea49a73a9656c99fe27ecda591049be9d53

Analysis

max time kernel
35s
max time network
42s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
11-01-2025 03:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4ae69707fe39339915373a1ec3adaea49a73a9656c99fe27ecda591049be9d53.exe
Size

607KB
MD5

9451be6a28dc660c832d444f7cc53a58
SHA1

077f6a146080489988113104f6b9985c9e806290
SHA256

4ae69707fe39339915373a1ec3adaea49a73a9656c99fe27ecda591049be9d53
SHA512

0ed05ba676db20cea8e7ea5aae10d215cdb7d22ce82dc7e8c7b433833b67896bc816fa4512d08b427f566d4e012384d44e9f2106e4e59287699ef200c8770c51
SSDEEP

12288:4nl1cUoV+I4MVKWE5SXa+1nhCF3pGtBM63blYrw2n5nh8zHB:4nluRgJSt9tD3blYrw8/0HB

Score

10^/10

redline sectoprat cheat discovery execution infostealer rat trojan

Malware Config

Extracted

Family

redline

Botnet

cheat

185.222.57.94:55615

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 5 IoCs

resource	yara_rule
behavioral1/memory/2712-29-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline
behavioral1/memory/2712-26-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline
behavioral1/memory/2712-24-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline
behavioral1/memory/2712-30-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline
behavioral1/memory/2712-32-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline

Redline family
redline
SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 5 IoCs

resource	yara_rule
behavioral1/memory/2712-29-0x0000000000400000-0x000000000041E000-memory.dmp	family_sectoprat
behavioral1/memory/2712-26-0x0000000000400000-0x000000000041E000-memory.dmp	family_sectoprat
behavioral1/memory/2712-24-0x0000000000400000-0x000000000041E000-memory.dmp	family_sectoprat
behavioral1/memory/2712-30-0x0000000000400000-0x000000000041E000-memory.dmp	family_sectoprat
behavioral1/memory/2712-32-0x0000000000400000-0x000000000041E000-memory.dmp	family_sectoprat

Sectoprat family
sectoprat

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2772	powershell.exe
2920	powershell.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2396 set thread context of 2712	2396	4ae69707fe39339915373a1ec3adaea49a73a9656c99fe27ecda591049be9d53.exe	38

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4ae69707fe39339915373a1ec3adaea49a73a9656c99fe27ecda591049be9d53.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4ae69707fe39339915373a1ec3adaea49a73a9656c99fe27ecda591049be9d53.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2820	schtasks.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
2396	4ae69707fe39339915373a1ec3adaea49a73a9656c99fe27ecda591049be9d53.exe
2396	4ae69707fe39339915373a1ec3adaea49a73a9656c99fe27ecda591049be9d53.exe
2396	4ae69707fe39339915373a1ec3adaea49a73a9656c99fe27ecda591049be9d53.exe
2396	4ae69707fe39339915373a1ec3adaea49a73a9656c99fe27ecda591049be9d53.exe
2396	4ae69707fe39339915373a1ec3adaea49a73a9656c99fe27ecda591049be9d53.exe
2396	4ae69707fe39339915373a1ec3adaea49a73a9656c99fe27ecda591049be9d53.exe
2396	4ae69707fe39339915373a1ec3adaea49a73a9656c99fe27ecda591049be9d53.exe
2396	4ae69707fe39339915373a1ec3adaea49a73a9656c99fe27ecda591049be9d53.exe
2396	4ae69707fe39339915373a1ec3adaea49a73a9656c99fe27ecda591049be9d53.exe
2396	4ae69707fe39339915373a1ec3adaea49a73a9656c99fe27ecda591049be9d53.exe
2396	4ae69707fe39339915373a1ec3adaea49a73a9656c99fe27ecda591049be9d53.exe
2772	powershell.exe
2920	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2396	4ae69707fe39339915373a1ec3adaea49a73a9656c99fe27ecda591049be9d53.exe
Token: SeDebugPrivilege	2920	powershell.exe
Token: SeDebugPrivilege	2772	powershell.exe
Token: SeDebugPrivilege	2712	4ae69707fe39339915373a1ec3adaea49a73a9656c99fe27ecda591049be9d53.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 2396 wrote to memory of 2772	2396	4ae69707fe39339915373a1ec3adaea49a73a9656c99fe27ecda591049be9d53.exe	29
PID 2396 wrote to memory of 2772	2396	4ae69707fe39339915373a1ec3adaea49a73a9656c99fe27ecda591049be9d53.exe	29
PID 2396 wrote to memory of 2772	2396	4ae69707fe39339915373a1ec3adaea49a73a9656c99fe27ecda591049be9d53.exe	29
PID 2396 wrote to memory of 2772	2396	4ae69707fe39339915373a1ec3adaea49a73a9656c99fe27ecda591049be9d53.exe	29
PID 2396 wrote to memory of 2920	2396	4ae69707fe39339915373a1ec3adaea49a73a9656c99fe27ecda591049be9d53.exe	31
PID 2396 wrote to memory of 2920	2396	4ae69707fe39339915373a1ec3adaea49a73a9656c99fe27ecda591049be9d53.exe	31
PID 2396 wrote to memory of 2920	2396	4ae69707fe39339915373a1ec3adaea49a73a9656c99fe27ecda591049be9d53.exe	31
PID 2396 wrote to memory of 2920	2396	4ae69707fe39339915373a1ec3adaea49a73a9656c99fe27ecda591049be9d53.exe	31
PID 2396 wrote to memory of 2820	2396	4ae69707fe39339915373a1ec3adaea49a73a9656c99fe27ecda591049be9d53.exe	33
PID 2396 wrote to memory of 2820	2396	4ae69707fe39339915373a1ec3adaea49a73a9656c99fe27ecda591049be9d53.exe	33
PID 2396 wrote to memory of 2820	2396	4ae69707fe39339915373a1ec3adaea49a73a9656c99fe27ecda591049be9d53.exe	33
PID 2396 wrote to memory of 2820	2396	4ae69707fe39339915373a1ec3adaea49a73a9656c99fe27ecda591049be9d53.exe	33
PID 2396 wrote to memory of 2292	2396	4ae69707fe39339915373a1ec3adaea49a73a9656c99fe27ecda591049be9d53.exe	35
PID 2396 wrote to memory of 2292	2396	4ae69707fe39339915373a1ec3adaea49a73a9656c99fe27ecda591049be9d53.exe	35
PID 2396 wrote to memory of 2292	2396	4ae69707fe39339915373a1ec3adaea49a73a9656c99fe27ecda591049be9d53.exe	35
PID 2396 wrote to memory of 2292	2396	4ae69707fe39339915373a1ec3adaea49a73a9656c99fe27ecda591049be9d53.exe	35
PID 2396 wrote to memory of 2840	2396	4ae69707fe39339915373a1ec3adaea49a73a9656c99fe27ecda591049be9d53.exe	36
PID 2396 wrote to memory of 2840	2396	4ae69707fe39339915373a1ec3adaea49a73a9656c99fe27ecda591049be9d53.exe	36
PID 2396 wrote to memory of 2840	2396	4ae69707fe39339915373a1ec3adaea49a73a9656c99fe27ecda591049be9d53.exe	36
PID 2396 wrote to memory of 2840	2396	4ae69707fe39339915373a1ec3adaea49a73a9656c99fe27ecda591049be9d53.exe	36
PID 2396 wrote to memory of 2832	2396	4ae69707fe39339915373a1ec3adaea49a73a9656c99fe27ecda591049be9d53.exe	37
PID 2396 wrote to memory of 2832	2396	4ae69707fe39339915373a1ec3adaea49a73a9656c99fe27ecda591049be9d53.exe	37
PID 2396 wrote to memory of 2832	2396	4ae69707fe39339915373a1ec3adaea49a73a9656c99fe27ecda591049be9d53.exe	37
PID 2396 wrote to memory of 2832	2396	4ae69707fe39339915373a1ec3adaea49a73a9656c99fe27ecda591049be9d53.exe	37
PID 2396 wrote to memory of 2712	2396	4ae69707fe39339915373a1ec3adaea49a73a9656c99fe27ecda591049be9d53.exe	38
PID 2396 wrote to memory of 2712	2396	4ae69707fe39339915373a1ec3adaea49a73a9656c99fe27ecda591049be9d53.exe	38
PID 2396 wrote to memory of 2712	2396	4ae69707fe39339915373a1ec3adaea49a73a9656c99fe27ecda591049be9d53.exe	38
PID 2396 wrote to memory of 2712	2396	4ae69707fe39339915373a1ec3adaea49a73a9656c99fe27ecda591049be9d53.exe	38
PID 2396 wrote to memory of 2712	2396	4ae69707fe39339915373a1ec3adaea49a73a9656c99fe27ecda591049be9d53.exe	38
PID 2396 wrote to memory of 2712	2396	4ae69707fe39339915373a1ec3adaea49a73a9656c99fe27ecda591049be9d53.exe	38
PID 2396 wrote to memory of 2712	2396	4ae69707fe39339915373a1ec3adaea49a73a9656c99fe27ecda591049be9d53.exe	38
PID 2396 wrote to memory of 2712	2396	4ae69707fe39339915373a1ec3adaea49a73a9656c99fe27ecda591049be9d53.exe	38
PID 2396 wrote to memory of 2712	2396	4ae69707fe39339915373a1ec3adaea49a73a9656c99fe27ecda591049be9d53.exe	38

C:\Users\Admin\AppData\Local\Temp\4ae69707fe39339915373a1ec3adaea49a73a9656c99fe27ecda591049be9d53.exe
"C:\Users\Admin\AppData\Local\Temp\4ae69707fe39339915373a1ec3adaea49a73a9656c99fe27ecda591049be9d53.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2396
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\4ae69707fe39339915373a1ec3adaea49a73a9656c99fe27ecda591049be9d53.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2772
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\XfCVNRqAnhjg.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2920
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\XfCVNRqAnhjg" /XML "C:\Users\Admin\AppData\Local\Temp\tmpD71D.tmp"
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:2820
- C:\Users\Admin\AppData\Local\Temp\4ae69707fe39339915373a1ec3adaea49a73a9656c99fe27ecda591049be9d53.exe
  "C:\Users\Admin\AppData\Local\Temp\4ae69707fe39339915373a1ec3adaea49a73a9656c99fe27ecda591049be9d53.exe"
  2⤵
  PID:2292
- C:\Users\Admin\AppData\Local\Temp\4ae69707fe39339915373a1ec3adaea49a73a9656c99fe27ecda591049be9d53.exe
  "C:\Users\Admin\AppData\Local\Temp\4ae69707fe39339915373a1ec3adaea49a73a9656c99fe27ecda591049be9d53.exe"
  2⤵
  PID:2840
- C:\Users\Admin\AppData\Local\Temp\4ae69707fe39339915373a1ec3adaea49a73a9656c99fe27ecda591049be9d53.exe
  "C:\Users\Admin\AppData\Local\Temp\4ae69707fe39339915373a1ec3adaea49a73a9656c99fe27ecda591049be9d53.exe"
  2⤵
  PID:2832
- C:\Users\Admin\AppData\Local\Temp\4ae69707fe39339915373a1ec3adaea49a73a9656c99fe27ecda591049be9d53.exe
  "C:\Users\Admin\AppData\Local\Temp\4ae69707fe39339915373a1ec3adaea49a73a9656c99fe27ecda591049be9d53.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:2712

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpD71D.tmp

Filesize
1KB

MD5
68537a7bd19456d346e055db444482fc

SHA1
a72aa40061d9508455a12cb3c098aafad85b292d

SHA256
50c4a69f6a7264d36ae0cadaafef316c2f255483ceedec221690d56786ed2c47

SHA512
67cfdc6c2b9efe80539fddb6882409f67a4f158fef02a4983f0c16b780eed026d7e9f17bb47d3b694466e6e06dbc6202ed9aef34281f69e0be92d3d690746590

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
ca945a52eca077e4594f8d25a9a3aaa6

SHA1
5ce26a4b84eb79e826aabc2218bd8c5220e4f5f2

SHA256
17957cd887a1b7cb3eb9272e61f4b59d3aac82cc665609b57d31eb8900c3f534

SHA512
f62a0db148fb67eabd2eb3e45fd7cf704a7fe79e486cbb8a5d61dde947b22ac6e189e9cc7b174c1eb049bed58619697127293b7c6f617fd3d813478a384b7f90

Download Submit
memory/2396-4-0x000000007447E000-0x000000007447F000-memory.dmp

Filesize
4KB

Download
memory/2396-3-0x0000000001F50000-0x0000000001F6C000-memory.dmp

Filesize
112KB

Download
memory/2396-0-0x000000007447E000-0x000000007447F000-memory.dmp

Filesize
4KB

Download
memory/2396-5-0x0000000074470000-0x0000000074B5E000-memory.dmp

Filesize
6.9MB

Download
memory/2396-6-0x0000000074470000-0x0000000074B5E000-memory.dmp

Filesize
6.9MB

Download
memory/2396-7-0x0000000004B20000-0x0000000004B82000-memory.dmp

Filesize
392KB

Download
memory/2396-2-0x0000000074470000-0x0000000074B5E000-memory.dmp

Filesize
6.9MB

Download
memory/2396-1-0x00000000002B0000-0x000000000034E000-memory.dmp

Filesize
632KB

Download
memory/2396-33-0x0000000074470000-0x0000000074B5E000-memory.dmp

Filesize
6.9MB

Download
memory/2712-28-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2712-26-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2712-24-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2712-22-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2712-20-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2712-30-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2712-32-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2712-29-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download